H3C Technologies H3C S12500 Series Switches - Manual (Page 28)

12
Introduction to VPN instances
VPNs must be isolated from one another and from the public network. As shown in Figure 10 , VPN A and
VPN B separately access the public network through PE devices.
Figure 10 VPN networking diagram
• The provider (P) device belongs to the public network. The customer edge (CE) devices belong to
their respective VPNs. Each CE device serves its own VPN and maintains only one set of forwarding
mechanisms.
• The provider edge (PE) devices connect to the public network and the VPNs. Each PE device must
strictly distinguish the information for different networks and maintain a separate forwarding
mechanism for each network. On a PE device, a set of software and hardware that serve the same
network forms an instance. Multiple instances can exist on the same PE device, and an instance can
reside on different PE devices. On a PE device, the instance for the public network is called the
public network instance, and those for VPNs are called VPN instances.
Multicast application in VPNs
A PE device that supports multicast for VPNs does the following operations:
• Maintains an independent set of multicast forwarding mechanisms for each VPN, including the
multicast protocols, PIM neighbor information, and multicast routing table. In a VPN, the device
forwards multicast data based on the forwarding table or routing table for that VPN.
• Implements the isolation between different VPNs.
• Implements information exchange and data conversion between the public network and VPNs.
As shown in Figure 10 , when a multicast source in VPN A sends a multicast stream to a multicast group,
only the receivers that belong to both the multicast group and VPN A can receive the multicast stream.
The multicast data is multicast both in VPN A and in the public network.
VPN A
VPN A
VPN A
VPN B VPN B
Public network
P
PE 1
PE 2
PE 3
CE b3
CE a2
CE a3
CE b1
CE a1
CE b2